The Disinformation Playbook: How Campaigns Are Built and Where They Break

The word "disinformation" is now used so loosely that it often means little more than "claims I disagree with." That is a loss, because the term describes something specific and well studied: the deliberate, organized spreading of false or misleading material by someone who conceals their identity or purpose. It is a craft with a history, a division of labour, and a fairly stable set of methods. Those methods are indifferent to ideology. They have been used by intelligence services of rival blocs, by commercial marketers, and by political operatives of the left and the right. Learning the playbook is more useful than learning a list of bad actors, because the actors change and the plays do not.

Thomas Rid's history Active Measures traces organized disinformation through the twentieth century. Two of his observations are worth carrying forward. First, it was never a one-sided practice: Rid documents American-backed forgery and front-publication operations run out of 1950s Berlin alongside the much larger and longer-lived Soviet and Eastern bloc programmes. Second, the most effective operations were rarely pure invention. They blended accurate material with a small amount of fabrication, for example a genuine cache of documents with one forged letter slipped in, because true details lend credibility to the false one and because the target's denials then sound like a cover-up. See the entries on leak forgery and screenshot forgery.

Rid also argues that the aim was often not to persuade anyone of a particular claim but to widen existing divisions in the target society and to erode trust in its institutions. An operation could succeed even after being exposed, if the exposure itself left people feeling that nothing could be believed.

Campaigns start where resistance is lowest. Michael Golebiewski and danah boyd named one such opening the data void: a search term for which little or no reliable content exists. Voids appear in the first hours of a breaking news event, before journalists have published anything; around obscure or newly coined phrases; and around terms that mainstream sources avoid. A manipulator who fills the void first, and then encourages people to "search for it yourself," owns the results page. The searcher feels they have done independent research. They have been walked to a prepared destination.

Alice Marwick and Rebecca Lewis, in their Data and Society report on media manipulation, describe how fringe material reaches mass audiences. The key move is trading up the chain. A claim is planted on a forum or a small blog, picked up by a mid-sized partisan outlet or influencer hungry for content, and eventually covered by mainstream news, sometimes only to debunk it. Each step strips away the dubious origin and adds a more respectable citation. Marwick and Lewis stress that the manipulators they studied understood the incentives of newsrooms very well: the demand for novelty, the speed of the cycle, the reliance on social media as a source, and the habit of covering "what people are saying online." Related tactics include source hacking, in which journalists and experts are fed material through intermediaries so that they cannot see where it came from.

Christopher Paul and Miriam Matthews of RAND described the contemporary Russian state propaganda model as a firehose of falsehood, with four features: it is high-volume and multichannel; it is rapid, continuous, and repetitive; it shows no commitment to objective reality; and it shows no commitment to consistency. The last two break the rules of traditional public relations, where being caught in a contradiction is costly. Paul and Matthews draw on experimental psychology to explain why the model can work anyway. Messages received from many apparent sources are more persuasive than the same message from one. First impressions are sticky. And repetition breeds familiarity, which the mind readily mistakes for truth. Their blunt advice to defenders was not to expect to "counter the firehose of falsehood with the squirt gun of truth," but to get ahead of it and to focus on its effects rather than rebutting each claim.

The appearance of many independent voices is cheap to manufacture with sockpuppets, bot amplification, and astroturfing. This is the part of the playbook that domestic operatives have borrowed most readily. In the United States, press investigations have documented a Democratic-aligned experiment with false-flag social media tactics during the 2017 Alabama Senate special election, and a 2020 operation linked to a conservative youth organization that paid teenagers to post coordinated messages from their own accounts, which platforms subsequently removed. The scale of each was small. The point is that the technique has no party.

The least intuitive finding in this literature comes from Kate Starbird and her colleagues at the University of Washington. Studying several online information operations, they concluded that disinformation is best understood as collaborative work. Orchestrated actors supply frames, memes, and an occasional fabricated item; sincere members of online communities then adapt, improve, and spread them, often unaware of where the material originated. The operators do not so much inject beliefs as cultivate communities that were already inclined to certain conclusions.

In earlier work on the #BlackLivesMatter conversation of 2016, the same group found accounts run by the Internet Research Agency in St Petersburg embedded on both sides: some impersonated Black activists, others impersonated conservative, pro-police Americans. Each persona won followers by affirming the group's identity and then modelled contempt for the other side. If you were active in either community at the time, it is possible that an account you found agreeable was a character being played. That is an uncomfortable thought, and the discomfort is appropriate for everyone, not only for one's opponents.

Fact-checking matters, and the evidence says that corrections do improve the accuracy of people's beliefs (see our post on the backfire effect). But it is structurally late. The lie is cheap and the correction is expensive; the lie travels through communities the correction never reaches; and a campaign with no commitment to consistency simply moves to the next claim. Coverage of a fringe claim can also complete the laundering process by giving it the reach it lacked.

Jon Roozenbeek and Sander van der Linden tested an alternative built on William McGuire's inoculation theory from the 1960s: expose people to a weakened dose of the manipulation technique, explain how it works, and they become better at resisting it later. Their browser game Bad News casts the player as a would-be disinformation tycoon and teaches six techniques: impersonation, emotional language, polarization, conspiracy framing, discrediting opponents, and trolling. In a large pre-post study, players rated manipulative example posts as less reliable after playing, and the effect held across education levels, ages, and political leanings. The study had limits that the authors acknowledge, including a self-selected sample and no randomized control group; later randomized work by the same group has supported the basic finding while showing that the effect fades without reinforcement. Technique-based inoculation has a practical advantage: it does not depend on knowing what the next false claim will be.

• Trace the chain. Before sharing, ask where the claim first appeared, not where you saw it. If the trail ends at an anonymous post or a screenshot with no link, treat it as unverified.
• Be wary of supplied search terms. When someone tells you exactly what phrase to search, open a second tab and search the topic in your own words, and check what established outlets of differing leanings say.
• Slow down in the first hours of breaking news. That is when data voids are widest and errors most common.
• Be suspicious of leaks that are too perfect. A large authentic dump is an ideal hiding place for one forged page. Wait for verification of the specific document that matters.
• Notice when content flatters your side and enrages you at the other. That emotional signature is the one constant across the operations studied. It does not prove a claim false. It is a reason to check before amplifying.
• Do not amplify in order to mock. Quote-posting a fabrication spreads it. If you must respond, lead with the accurate information and describe the falsehood without linking to it.
• Judge accounts by behaviour over time, not by how well they speak your group's language.

None of this requires cynicism. The goal of much disinformation is precisely to persuade people that nothing can be known, so that they stop trying. The better response is ordinary, slightly tedious verification, applied evenly to claims you like and claims you do not. For more tactics and counters, see Defenses, or test a suspicious post in the detector.